sheetrat | cc9add661881b756e15ab1a8e4c873bf2103dea2968f998fa9038daff9d0d9f2

General

Target
iu1je9lzee4fp4p6.exe
Size 374KB
Sample260628-vvfysaat9v
SHA256 cc9add661881b756e15ab1a8e4c873bf2103dea2968f998fa9038daff9d0d9f2
MD5 c20be4bb795fa6c93365d172e44548ba
SHA1 72265a5924da8dd5555a5097383f65a3d3e20ce3
SHA512 f54e9e57610ce147fd7b937a46e12b90226d661ff6b0003578fb30a1b0cc74f653bd9178f58da4a37d3326b9f7a314ca10a18bdc4c586905eda09a7d76501daa
SSDEEP 6144:mVZ139wz4ZoeETEW1gbpJA3KpSL0pDf2QEKbf:mVZR9ULePJA3KY0pqf+
TLSH
T1D8844A43BBD000BAE5BE453848735619A73AF8214B62EBDF169404ED0F26BC5DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  iu1je9lzee4fp4p6.exe
- Size 374KB
- SHA256 cc9add661881b756e15ab1a8e4c873bf2103dea2968f998fa9038daff9d0d9f2
- MD5 c20be4bb795fa6c93365d172e44548ba
- SHA1 72265a5924da8dd5555a5097383f65a3d3e20ce3
- SHA512 f54e9e57610ce147fd7b937a46e12b90226d661ff6b0003578fb30a1b0cc74f653bd9178f58da4a37d3326b9f7a314ca10a18bdc4c586905eda09a7d76501daa
- SSDEEP 6144:mVZ139wz4ZoeETEW1gbpJA3KpSL0pDf2QEKbf:mVZR9ULePJA3KY0pqf+
- TLSH
  T1D8844A43BBD000BAE5BE453848735619A73AF8214B62EBDF169404ED0F26BC5DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan adware spyware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2